Relion
®
Protection and Control
620 series
Modbus Communication Protocol Manual
Page 1: ...Relion Protection and Control 620 series Modbus Communication Protocol Manual...
Page 2: ......
Page 3: ...Document ID 1MRS757645 Issued 2015 12 11 Revision B Product version 2 0 FP1 Copyright 2015 ABB All rights reserved...
Page 4: ...s document is furnished under a license and may be used copied or disclosed only in accordance with the terms of such license Trademarks ABB and Relion are registered trademarks of the ABB Group All o...
Page 5: ...ted and communicate data and information via a network interface which should be connected to a secure network It is the sole responsibility of the person or entity responsible for network administrat...
Page 6: ...d concerning electrical equipment for use within specified voltage limits Low voltage directive 2006 95 EC This conformity is the result of tests conducted by ABB in accordance with the product standa...
Page 7: ...er instances 13 Connection to clients 13 Protocol server attachment to a client 14 Several identical client connections 14 Protocol data mapping to server instances 14 Modbus link alternatives 15 Seri...
Page 8: ...unctions 33 Control operations through 4X register structures 33 Additional control operation features 35 Control bit configuration 36 System status registers 38 SSR1 38 SSR2 39 SSR3 40 SSR4 40 SSR5 4...
Page 9: ...A protocol 65 Supported SPA data 65 Reading of SPA data 65 Reading of one register 66 Reading of two registers 66 Special reading of indication bits 67 Writing of SPA data 68 SPA events 68 Event outlo...
Page 10: ...4...
Page 11: ...es the communication system engineer or system integrator responsible for pre engineering and engineering for communication setup in a substation from a protection relay perspective The system enginee...
Page 12: ...l Cyber security deployment guideline GUID 6087BB7C D675 413B B1CD C4FEEEED8EEB V2 EN Figure 1 The intended use of documents during the product life cycle Product series and product specific manuals c...
Page 13: ...der certain operational conditions operation of damaged equipment may result in degraded process performance leading to personal injury or death Therefore comply fully with all warning and caution not...
Page 14: ...ssages and monitored data names are shown in Courier font When the function starts the START output is set to TRUE This document assumes that the parameter setting visibility is Advanced Section 1 1MR...
Page 15: ...e it is possible to build multidrop networks or point to point communication connections There can only be one Modbus master unit on a Modbus serial network The Modbus master unit communicates with on...
Page 16: ...many Modbus memory areas as possible The users may then choose the memory areas that are most suitable for their Modbus master systems 2 1 4 Terms and definitions Modbus data appear in different memo...
Page 17: ...in addition to this document It is essential to know the device type configuration name and SW version to locate the correct Modbus memory map listings Table 1 Example of IED information needed to loc...
Page 18: ...12...
Page 19: ...t protocol mapping or data outlook can be modified freely 3 Several clients Several protocol instances Several protocol mappings The IED is intended to operate toward several protocol clients Some or...
Page 20: ...ent IP address is to be defined In this case the client s IP address is ignored TCP port This parameter can be used in conjunction with the Client IP address setting thus allowing only a certain IP ad...
Page 21: ...ial interfaces The Modbus link mode can be either Modbus RTU or Modbus ASCII Modbus serial communication can run on two separate serial ports simultaneously The Modbus serial link characteristics can...
Page 22: ...according to the link standard especially true with slower baud rates The start delay parameter adds idle characters before the transmission thus increasing the silent interval between the Modbus RTU...
Page 23: ...3 These exceptions usually reveal the IED application level rejections That is the IED application rejects the request at this moment under the current circumstances The exception can also mean that...
Page 24: ...it 8 data bits the least significant bit is sent first 1 bit for even odd parity no bit if parity is not used 1 stop bit if parity is used 2 stop bits if parity is not used Table 4 ASCII characters Co...
Page 25: ...eal configuration errors on the Modbus client s side Transmitted exc B Total amount of exception responses 3 These exceptions reveal the IED application level rejections The counters are reset when th...
Page 26: ...ion event counters are cleared Before this a normal response will be sent provided that the port is not in the listen only mode If the port is in the listen only mode no response will be sent 04 Force...
Page 27: ...he number of items in the query is incorrect 03 Illegal data value A value contained in the query data field is out of range 3 4 Modbus application data 3 4 1 Modbus data objects The Modbus protocol i...
Page 28: ...a types Control operations include automatic checking for authorization and local and remote blockings as well as preventing simultaneous controlling by multiple clients Application data compatibility...
Page 29: ...y the stack regardless of whether the data is read or not 3 4 3 2 Data in monitoring direction All data in the monitoring direction is available through the 3X and 4X memory areas This includes the di...
Page 30: ...ED indications are shown as two adjacent Modbus bits in the Modbus memory map The two bits represent the momentary position and the momentary change detection state of the indication MOM MCD LATCH A07...
Page 31: ...he MCD bits reveals if the object has changed its position several times since the Modbus master last scanned it In addition the open and close bits are also coded using MOM values only among with a f...
Page 32: ...changes its value bit N 1 in SSR3 gets value 1 The SSR3 bit value is automatically reset when master reads it Event enable Unchecked1 No Modbus events generated from this point Checked Modbus event i...
Page 33: ...es are mapped this way 3 A few Modbus register values are available so that the Modbus stack directly reads the momentary value of the mapped source object These values are never cached in the Modbus...
Page 34: ...tion to find out the CT or VT ratio being used If scaling of primary values is used the IED must be rebooted if the CT VT ratio settings are changed Otherwise Modbus continues using the old CT VT sett...
Page 35: ...ble register continues calculating upwards from this value Rescaling can also be applied on measurands and Modbus counter integer values The original Modbus value can be edited to show full hours tens...
Page 36: ...asurand registers are mirrored on both 3x and 4x Modbus register areas Registers can be accessed in the Modbus Communication Management tool in PCM600 under tabs 3x input registers and 4x holding regi...
Page 37: ...lues Current is in A and voltage is in kV Scale Any real value Modbus value is scaled as Value Scale Offset The result is a correctly rounded integer value If the Modbus value exceeds the register siz...
Page 38: ...pe The IEC 61850 double point control objects can be configured either into the direct operate or select before operate mode An IEC 61850 double point output cannot support both direct operate and sel...
Page 39: ...ient and thus blocked If a positive acknowledgement is returned the control command has been initiated by the IED 3 4 6 2 Control operations through 4X register structures The control outputs can be o...
Page 40: ...ister If no password is defined for the control structure this register is not checked by the IED For example having cd as the last two characters of the password the correct register value to be writ...
Page 41: ...ed that means already reserved by another client If a positive acknowledgement is returned the control command has been initiated inside the IED 3 4 6 3 Additional control operation features Normal or...
Page 42: ...ts For example in the case of a control made to a motor controlled disconnector the control sequence lasts 10 seconds Master can monitor the command progress By polling the SSR6 register and examine t...
Page 43: ...o prevent unwanted remote operations is to remove the control points from the memory map Generic control points might be in use for internal purposes by the relay configuration In such case effects ca...
Page 44: ...and 101 3 4 7 System status registers The Modbus SSRx 16 bit system status registers are located at the beginning of the regular Modbus map at addresses 40128 40133 The regular Modbus map starts from...
Page 45: ...e bits give an overview of the IED s mode For example bit 6 is activated if the IED s configured time synchronization source is lost Table 19 16 bit SSR2 register Bit Meaning 0 Test mode 1 Device is s...
Page 46: ...t code 4 to the event record selection register 49251 Bit 9 is set to 1 when a fault record has been loaded into registers starting from 49402 The bit is reset when the client writes the reset code 4...
Page 47: ...anged 1 New peak demand values 6 Data in category 7 changed 0 7 Data in category 8 changed 0 8 Data in category 9 changed 0 9 Data in category 10 changed 0 10 Data in category 11 changed 0 11 Data in...
Page 48: ...e in local mode 202 Control operation reserved by another client 203 Select timeout or Execute Cancel without select 204 Control operation internally blocked 205 Control operation timed out 250 Other...
Page 49: ...riginal location The bit 16 is the first valid bit address in the address space because the register and bit addresses overlap and the register addresses start from the register location 1 The bit add...
Page 50: ...xactly the same value range as the value from the replaced unit For multiplicative and divisor scaling the register value always saturates at the min and max values for the register type in question T...
Page 51: ...tValue sourceValue multiplicand Divisior scaling Operation UDR_resultValue sourceValue Divisor 3 4 8 8 UDR register configuration UDR registers are read only registers mirrored both on input register...
Page 52: ...1 0 nominal value UDR register size v2 Same as the source register1 If the Modbus source register is a 16 bit register then the UDR register is automatically also 16 bit This principle applies to 32 b...
Page 53: ...re ignored Min In Any real value Scaling argument 1 Used also as the scaling factor for Multiplicative and Divisor scaling Max In Any real value Scaling argument 2 Min Out Any real value Scaling argum...
Page 54: ...liseconds Modbus event generation on off is selectable for each individual momentary bit in the Modbus memory map It is possible to define whether events are to be generated from the rising edge or bo...
Page 55: ...ion 49260 Data Object ID 2 Modbus address or UID low word 49261 Data Value Modbus data value Value into which object has changed 49262 Data Value Additional data The event record can have two differen...
Page 56: ...rd registers After the client has read out this record the next record becomes the oldest unread The client can continue with the selection code 1 by reading out the oldest unread event record again S...
Page 57: ...r moment Time stamp registers Time stamp is either in local time or UTC time The time stamp alternative is selected with a Modbus parameter Time stamp registers usually hold two data values in the hig...
Page 58: ...ation bit is set in the IED s real time clock if the IED has not been synchronized Clock failure bit 12 The quality information bit is set in the IED s real time clock if the clock has a severe failur...
Page 59: ...atus X Table 29 Interpretation of the one bit data value Register 49261 binary coded value Meaning xxxx xxxx xxxx xxx0 Object in OFF position xxxx xxxx xxxx xxx1 Object in ON position Table 30 Interpr...
Page 60: ...equential event records to be returned for reading shall be written to the Num of records register 49250 in front of the selection register This number can be written once or it can be rewritten for e...
Page 61: ...Stamp 1 49255 TimeStamp 1 49256 TimeStamp 1 49257 TimeStamp 1 49258 Event Type 1 49259 Data Object Id 1_1 49260 Data Object Id 2_1 49261 Data Value 1 49262 Data Value 1 49263 Sequence Number 2 Event r...
Page 62: ...s Modbus dependent and the data organization and buffer size differ from the IED s initial system level registrations When the Modbus fault record buffer becomes full the IED overwrites the oldest rec...
Page 63: ...1 The selection code defines the type of read operation that the client wants to do The selected fault record is loaded by the IED into the following N registers 49402 NNNN Second the client reads out...
Page 64: ...ment value defines how many records backwards from the newest fault record the reading is to be moved For example the ten latest fault records can be read out at any time by first selecting 10 reading...
Page 65: ...al time 1 UTC time 14 Time stamp source 0 Internal application 1 Modbus stack 13 Clock not synchronized 0 Synchronized 1 Time not synchronized 12 Clock failure 0 Clock OK 1 Clock failure 11 0 Reserved...
Page 66: ...D s local time at location 49201 49208 and the internal UTC time at the location 49211 49218 Time synchronization can be given either to the local time structure or to the UTC time structure The IED a...
Page 67: ...ster 49201 49211 When the value 2 is written the timesync registers are latched onto the IED s internal clock and the reservation in 49201 49211 is released The Modbus broadcast address cannot be used...
Page 68: ...aracter coding in the Modbus registers Modbus register ASCII character Register 1 High byte ASCII character 1 Register 1 Low byte ASCII character 2 Register 2 High byte ASCII character 3 3 4 13 2 ASCI...
Page 69: ...artup The clock might not be accurate and the data can be corrupted Table 39 Reset time structure Address Register Values Comment 49221 TimeStamp Year Month High byte year low byte month 49222 TimeSta...
Page 70: ...s produced by the IEC 61850 based IED applications The manufacturer s selection of important signals may not always serve every customer Any non protocol mapped internal signal can be freely connected...
Page 71: ...available for the SPA protocol If data is not available through the Modbus interface it is not available for the SPA protocol either 3 5 2 Supported SPA data The IED supports general SPA data The IED...
Page 72: ...25D 52342 CC I32 Read the register as one 16 bit hexadecimal value 25R138I32 CC 25D CC76 CC It is also possible to read several consecutive 16 bit registers in one SPA read message The register value...
Page 73: ...ister can be read as a regular 16 bit register revealing every bit Example 25R223I1 16 CC 25D 1 0 0 1 1 1 1 0 0 0 1 1 0 0 1 1 CC I21 28 It is also possible to read the logical OR operation result of e...
Page 74: ...s 0 the channel number is omitted in the command message 25WO2052 1 CC 25A CC Writing the value 7 to the Modbus register address 9051 25W1O9051 7 CC 25A CC 3 5 5 SPA events The MOM MCD bits available...
Page 75: ...ster area can also be accessed from the SPA protocol The SPA protocol standard defines that the highest possible SPA channel number is 999 This would correspond to Modbus register address 999 Some SPA...
Page 76: ...LEDPTRC1 Str general and LEDPTRC1 Op general correspond to the Start Operarate LED states on the IED front CB1 Open Close and Fault are all Circuit Breaker1 position data Furthermore it is assumed tha...
Page 77: ...ly filled up with the Modbus values to be transferred to Profibus offset octets Then the data can be polled into SPA ZC 302 using two register reads at a time 3 6 Troubleshooting Table 41 Troubleshoot...
Page 78: ...72...
Page 79: ...s Link mode 1 RTU 2 ASCII 1 RTU Selects between ASCII and RTU mode For TCP this should always be RTU TCP port 1 65535 1 502 Defines the listening port for the Modbus TCP server Default 502 Parity 0 no...
Page 80: ...5 Password for control operations using Control Struct mechanism which is available on 4x memory area ControlStructPWd 6 Password for control operations using Control Struct mechanism which is availa...
Page 81: ...ed exception responses 3 Checksum errors 0 2147483648 Checksum errors detected CnReject no sockets 0 2147483648 Connection rejections due to no free sockets CnReject unregistered 0 2147483648 Connecti...
Page 82: ...76...
Page 83: ...connecting a family of frame based computer networking technologies into a LAN HMI Human machine interface HW Hardware IEC International Electrotechnical Commission IEC 61850 International standard fo...
Page 84: ...data acquisition SEC Security violation SPA Str mberg protection acquisition ABB proprietary serial master slave protocol used in substation automation for point to point communication SPC Single poi...
Page 85: ...UTC Coordinated universal time VT Voltage transformer WHMI Web human machine interface 1MRS757645 B Section 5 Glossary 620 series 79 Communication Protocol Manual...
Page 86: ...80...
Page 87: ...81...
Page 88: ...11 Fax 358 10 22 41094 www abb com mediumvoltage www abb com substationautomation ABB Nanjing SAC Power Grid Automation Co Ltd NO 39 Shuige Road Jiangning Development Zone 211100 Nanjing China Phone 8...
